CVE-2026-67550 in node-re2
Summary
by MITRE • 07/30/2026
re2 provides Node.js bindings for Google's RE2 regular expression engine. Prior to 1.25.2, re2 validates lastIndex against the UTF-8 byte length of a subject but uses it as a UTF-16 code-unit offset in exec, test, match, replace, and split, allowing an attacker-influenced lastIndex on a non-ASCII subject to trigger an out-of-bounds heap read and an uncatchable process crash, with limited heap information disclosure in some cases. This issue is fixed in 1.25.2.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 07/30/2026
The re2 Node.js module presents a critical security vulnerability that stems from a fundamental mismatch in how string offsets are handled during regular expression operations. This vulnerability affects versions prior to 1.25.2 and specifically targets the validation mechanism for the lastIndex property when processing UTF-8 encoded strings. The flaw occurs because the library validates the lastIndex parameter against the UTF-8 byte length of the subject string but subsequently utilizes this value as a UTF-16 code-unit offset during execution of core methods including exec, test, match, replace, and split operations.
The technical implementation details reveal that when an attacker provides a malicious lastIndex value on a non-ASCII subject string, the validation logic incorrectly interprets the offset in terms of UTF-8 bytes rather than UTF-16 code units. This discrepancy creates a scenario where an out-of-bounds heap read can occur during regular expression processing, as the library attempts to access memory locations beyond the allocated buffer boundaries. The vulnerability manifests particularly when dealing with multi-byte UTF-8 characters that require multiple bytes to represent single Unicode code points in UTF-16 encoding.
The operational impact of this vulnerability extends beyond simple denial-of-service conditions, as it can trigger uncatchable process crashes that are extremely difficult to recover from in production environments. The heap information disclosure aspect adds additional security concerns, potentially exposing sensitive data stored in adjacent memory locations to attackers who can craft specific input patterns to maximize the information leakage. This type of vulnerability falls under CWE-129 Input Validation and CWE-787 Out-of-bounds Write, representing a classic case where improper boundary checking leads to memory safety issues.
The attack surface is particularly concerning given that re2 is widely used for regular expression processing in Node.js applications, making it a prime target for exploitation in web applications and server-side code. The vulnerability can be exploited through any input that flows into the affected regular expression methods, including user-provided data, HTTP request parameters, or any other source that might influence the lastIndex property during pattern matching operations. This aligns with ATT&CK technique T1059 Command and Scripting Interpreter where attackers may leverage such vulnerabilities to disrupt service availability and potentially extract information from memory.
Organizations using affected versions of re2 should immediately upgrade to version 1.25.2 or later, which implements proper offset validation that consistently treats lastIndex as a UTF-16 code-unit offset throughout all operations. The fix ensures that validation and execution phases use the same offset semantics, eliminating the possibility of out-of-bounds memory access. Additional mitigations include implementing proper input sanitization for any data that might influence regular expression operations, monitoring for unusual process crashes, and considering alternative regex engines that have been more thoroughly vetted for similar boundary condition vulnerabilities in the Node.js ecosystem.